JP7307116B2 - IN-VEHICLE SOFTWARE UPDATE METHOD AND IN-VEHICLE SYSTEM - Google Patents

Description

The present invention relates to an in-vehicle software update method and an in-vehicle system.

2. Description of the Related Art In recent vehicles, attempts have been made to adopt an OTA (Over The Air) software update system that updates the software of an in-vehicle system using wireless communication. However, such software update has various problems.

Therefore, for example, in Patent Document 1, the remaining capacity of the battery is calculated from the read voltage value and temperature, and the time required for memory rewriting and the current value are used to calculate the power consumption of the battery during the time of rewriting the memory. Predicting the quantity (current value x time) is disclosed. Furthermore, it is disclosed that if the remaining capacity does not exceed the predicted amount of electricity, the rewrite process is restarted after reducing the power consumption of the area to which the rewrite target does not belong.

Further, in Patent Document 2, the state of the battery after rewriting the program is predicted based on the state of the battery at the start of rewriting of the program of the ECU and the scheduled processing time of the rewriting of the program, and the predicted battery state is used in the vehicle. It is disclosed that rewriting of the program is executed when the restartable condition is satisfied.

Further, in Patent Document 3, a first acquisition unit that acquires the remaining power amount of the battery, a second acquisition unit that acquires the predicted amount of power consumption in each in-vehicle control device until the update of the control program is completed, A determination unit is disclosed that determines whether or not the predicted remaining battery charge at the time of completion of update is equal to or greater than a threshold based on the remaining battery charge and the predicted power consumption. Furthermore, it is disclosed that, when it is determined during update of the control program that the predicted remaining power amount is less than the threshold, the user interface device outputs information prompting an operation to start charging the battery.

JP 2008-155892 A WO2012/017719 WO2019/030985

As shown in Patent Documents 1 to 3, when updating software, it is common to perform control in consideration of the remaining capacity of the battery and the predicted amount of power consumption during the software update period. be. However, there are cases where the state does not actually change as predicted due to various causes.

As a result, software update may be interrupted in the middle. Then, after returning to a state in which the software can be updated again, the software update is redone from the beginning. Therefore, by repeating the same operation many times from the beginning, wasteful processing is executed and extra power is consumed. Furthermore, if there are a large number of electronic control units (ECUs) to be updated, it is possible that the time required to complete the software update of the entire system will be significantly longer due to the effect of repeated processing that increases waste time. .

SUMMARY OF THE INVENTION The present invention has been made in view of the circumstances described above, and an object of the present invention is to provide an in-vehicle software update method and an in-vehicle system capable of reducing wasteful power consumption and wasted time caused by software update interruption. to provide.

In order to achieve the above object, an in-vehicle software update method and an in-vehicle system according to the present invention are characterized by the following (1) to (5).
(1) An in-vehicle software update method for updating software included in an in-vehicle system having a zone control unit capable of managing a plurality of controlled objects connected downstream,
holding the acquired update data in a first area secured in advance in the memory of the zone control unit;
before starting software update using the update data, calculating a predicted voltage value of the on-vehicle power supply at the time of completion of the update as a first predicted voltage value;
If the first voltage prediction value is equal to or greater than a first threshold, software update is started;
Get the voltage measurement value of the on-board power supply after starting the software update,
Acquiring a progress rate in the software update when the voltage measurement value decreases to a second threshold;
interrupting the software update if the progress rate is less than a predetermined set value;
If the progress rate is equal to or greater than the set value, the mode is switched to the power saving mode, the voltage prediction value of the onboard power supply at the time of completion of the update is calculated as a second voltage prediction value, and if the second voltage prediction value is equal to or greater than the first threshold. continues said software update,
Vehicle software update method.

(2) An in-vehicle system having a zone control unit capable of managing a plurality of controlled objects connected downstream,
The memory of the zone control unit has a first area capable of holding update data that can be used for updating software of a plurality of controlled objects,
The zone control unit
A function of calculating, as a first predicted voltage value, a voltage predicted value of an on-vehicle power supply at the time of completion of updating, before starting a software update using the update data in the first area;
a function of starting a software update when the first voltage prediction value is equal to or greater than a first threshold;
A function to obtain the voltage measurement value of the on-board power supply after starting the software update;
a function of acquiring a progress rate in the software update when the voltage measurement value decreases to a second threshold;
a function of interrupting the software update if the progress rate is less than a predetermined set value;
If the progress rate is equal to or greater than the set value, the mode is switched to the power saving mode, the voltage prediction value of the onboard power supply at the time of completion of the update is calculated as a second voltage prediction value, and if the second voltage prediction value is equal to or greater than the first threshold. is a function to continue the software update;
In-vehicle system with

(3) The zone control unit assigns a priority to each of the plurality of electric circuits under its control, and in the power saving mode, suppresses the power supply to the electric circuit with a lower priority among the plurality of electric circuits. to reflect changes in power supply in the calculation of the second voltage prediction value,
The in-vehicle system according to (2) above.

(4) The zone control unit stores the update data downloaded from a predetermined software supplier in the first area when the ignition of the vehicle is on, and stores the update data after the ignition is switched off. switch to data-based software update mode,
The in-vehicle system according to (2) or (3) above.

(5) After switching to the power saving mode, the zone control unit repeatedly acquires the voltage measurement value of the onboard power supply, and if the voltage measurement value drops to a first threshold, suspends the software update. do,
The in-vehicle system according to any one of (2) to (4) above.

According to the in-vehicle software update method having the above configuration (1), even if the voltage of the in-vehicle power source drops earlier than expected after starting the software update, the progress rate of the software update at that time is If it is equal to or greater than the set value, the software update can be continued as it is. Therefore, it is possible to reduce the situation where the same software update is repeated many times due to the occurrence of interruption, and wasteful power consumption and wasteful time can be reduced. Further, even if the software update progress rate is equal to or higher than the set value, the software update can be interrupted if the second voltage prediction value is less than the first threshold, so that the voltage of the on-vehicle power supply is maintained equal to or higher than the first threshold. can be managed as

According to the in-vehicle system having the above configuration (2), even if the voltage of the in-vehicle power supply drops earlier than expected after starting the software update, the progress rate of the software update at that time is set to the set value. If the above is the case, the software update can be continued as it is. Therefore, it is possible to reduce the situation where the same software update is repeated many times due to the occurrence of interruption, and wasteful power consumption and wasteful time can be reduced. Further, even if the software update progress rate is equal to or higher than the set value, the software update can be interrupted if the second voltage prediction value is less than the first threshold, so that the voltage of the on-vehicle power supply is maintained equal to or higher than the first threshold. can be managed as

According to the in-vehicle system having the above configuration (3), when the voltage of the in-vehicle power supply drops more quickly than expected after starting the software update, switching to the power saving mode allows the electric circuit with the low priority. function can be suppressed, and the consumption speed of the on-board power supply can be slowed down. This increases the probability that software update can be continued.

According to the in-vehicle system having the above configuration (4), when downloading the update data, the power supply power supplied from the vehicle's generator (alternator) can be used, so it is necessary to consider the consumption of the in-vehicle battery. Downloads can be performed efficiently even when there is no data. Also, when executing a software update, it is possible to start the update process while many ECUs are inactive, such as when the vehicle is parked. It is less likely to be affected, and the update process can be executed efficiently.

According to the in-vehicle system having the above configuration (5), even if the software update progress rate is equal to or higher than the set value and the software update is continued, the voltage of the in-vehicle power supply actually reaches the first threshold. If the voltage drops, the software update is interrupted at that point, so that the voltage of the on-vehicle power supply can be managed so as to maintain the voltage equal to or higher than the first threshold.

According to the in-vehicle software update method and in-vehicle system of the present invention, it is possible to reduce wasted power consumption and wasted time caused by interruption of software update. That is, even if the voltage of the on-board power supply drops earlier than expected after starting the software update, the software update can be continued if the progress rate of the software update at that time is equal to or higher than the set value. Therefore, it is possible to reduce situations where the same software update is repeated many times due to interruptions.

The present invention has been briefly described above. Furthermore, the details of the present invention will be further clarified by reading the following detailed description of the invention (hereinafter referred to as "embodiment") with reference to the accompanying drawings. .

FIG. 1 is a block diagram showing the configuration of an in-vehicle system according to an embodiment of the invention. FIG. 2 is a block diagram showing the in-vehicle system in a state different from that in FIG. FIG. 3 is a block diagram showing a specific example of the internal configuration of the zone ECU. FIG. 4 is a block diagram showing an example of state change of each component inside the zone ECU shown in FIG. FIG. 5 is a time chart showing an example of battery voltage changes when software update cannot be started due to voltage prediction. FIG. 6 is a time chart showing an example of battery voltage changes when software update can be started by voltage prediction. FIG. 7 is a flowchart showing the contents of software update control in the zone ECU. FIG. 8 is a block diagram showing the internal configuration of a zone ECU in a modified example. FIG. 9 is a block diagram showing an example of state changes of each component inside the zone ECU in the software update mode. FIG. 10 is a block diagram showing an example of state changes of each component inside the zone ECU in the sleep mode. FIG. 11 is a flow chart showing mode transition control in the zone ECU of FIG.

Specific embodiments relating to the present invention will be described below with reference to each drawing.

<Configuration of in-vehicle system>
FIG. 1 is a block diagram showing the configuration of an in-vehicle system 10 according to an embodiment of the invention. FIG. 2 is a block diagram showing the in-vehicle system 10 in a state different from that in FIG.

An in-vehicle system 10 installed in a vehicle 17 shown in FIG. 1 includes a central ECU 11, a zone ECU 12, a terminal ECU 13, a smart actuator 14, and the like. A communication line 18 connects between the central ECU 11 and the zone ECU 12 , and a communication line 19 connects between the zone ECU 12 and the terminal ECU 13 and the smart actuator 14 .

In an actual vehicle, a plurality of zones are formed on the same vehicle 17, and an independent zone ECU 12 is arranged for each zone. That is, central ECU11 is connected with several zone ECU12. In addition, zones may be assigned as a plurality of areas representing different locations such as left and right in space on the same vehicle 17, or may be assigned as a plurality of areas representing different functional groups.

The central ECU 11 integrates and manages the entire in-vehicle system 10 including a plurality of zones, and also has a gateway function for safely connecting to a communication network such as the Internet outside the vehicle using a wireless communication function. there is

Therefore, the zone ECU 12 shown in FIG. 1 is connected to the downstream side of the central ECU 11 positioned at the highest level on the vehicle 17 . The zone ECU 12 also manages the terminal ECU 13 and the smart actuator 14 connected downstream thereof.

The central ECU 11, the zone ECU 12, and the terminal ECU 13 incorporate a microcomputer capable of independent control and a communication function. The smart actuator 14 also has a function of changing the function of the actuator by software and a communication function.

Therefore, the zone ECU 12, the terminal ECU 13, and the smart actuator 14 shown in FIG. 1 each have software configured by programs and data required for their own operations. Also, each software is in a rewritable state by arranging it on, for example, a non-volatile memory. Therefore, each software can be updated (updated) as needed. In this embodiment, these software updates (SU) can be performed as OTA (Over The Air) using wireless communication.

In the in-vehicle system 10 shown in FIG. 1, the zone ECU 12 manages all updates of software used by itself and updates of software used by each of the terminal ECU 13 and the smart actuator 14 . The zone ECU 12 also includes an update dedicated (OTA SU) memory area 12a.

In the vehicle 17 of FIG. 1 , power required for the operation of the on-board system 10 can be supplied from the on-board battery 15 and the alternator 16 provided in the vehicle 17 . However, since the power generation of the alternator 16 stops when the engine stops, only the electric power stored in the vehicle battery 15 can be used when the vehicle 17 is parked.

Further, when the vehicle battery 15 is abnormally exhausted, the power supply from the vehicle battery 15 may be restricted. Whether or not the alternator 16 is operating can be identified by turning the ignition on and off. The zone ECU 12 shown in FIG. 1 identifies on/off of the ignition by monitoring the ignition signal SG-IG output from the vehicle 17 side.

In the in-vehicle system 10 of this embodiment, the cloud 20 is prepared as a supply source of update data for updating the software of each part. This cloud 20 is arranged, for example, on a server in a predetermined data center. This cloud 20 has a function of providing update data necessary for software update of the in-vehicle system 10 .

Therefore, when preparations are made for updating the software for the zone ECU 12, the software for the terminal ECU 13, and the software for the smart actuator 14, the software to be updated is stored on the cloud 20 as shown in FIG. Update programs 31, 32, and 33 corresponding to each are stored.

In the state of FIG. 1, the in-vehicle system 10 can download and acquire three update programs 31, 32, and 33 via wireless data communication 25, respectively. In the example shown in FIG. 1, an update program 31A downloaded from the cloud 20 is stored in the update dedicated memory area (first area) 12a. This update program 31A is the same copy as the update program 31 on the cloud 20 .

The update processing unit 12b of the zone ECU 12 can update its own software by reading the update program 31A in the update dedicated memory area 12a.

In the state of FIG. 2, update programs 32A and 33A obtained by downloading are stored in the update dedicated memory area 12a. The update programs 32A and 33A are copies of the same content as the update programs 32 and 33 on the cloud 20, respectively.

Therefore, in the state of FIG. 2, the update processing unit 13a can acquire the update program 32A in the update-dedicated memory area 12a through communication and update the software of the terminal ECU 13. FIG. Also, the update processing unit 14a can acquire the update program 33A in the update dedicated memory area 12a through communication and update the software of the smart actuator 14. FIG.

Normally, when downloading large-capacity update data via the wireless data communication 25, each part of the in-vehicle system 10 is expected to consume a relatively large amount of power over a long period of time. Therefore, in this embodiment, each update data is downloaded when the ignition of the vehicle 17 is on.

On the other hand, when actually updating the software on the in-vehicle system 10 using the downloaded update data, it is desirable to reduce the influence of interrupts from other ECUs unrelated to the update target. Also, when actually updating software, it is possible to restrict the operation of other ECUs unrelated to the update target, thereby suppressing the power consumption of the entire system. Therefore, the in-vehicle system 10 of the present embodiment updates software when the ignition of the vehicle 17 is off.

However, when the ignition of the vehicle 17 is off, only the electric power stored in the onboard battery 15 can be supplied, so it is necessary to prevent the vehicle 17 from stopping due to the dead battery. It also takes quite a long time to read the downloaded update data, start the software update, and complete it. In addition, since the zone ECU 12 and the like continue to consume power during this period, the zone ECU 12 needs to perform special control as will be described later so as to prevent the battery from running out.

<Configuration of zone ECU>
FIG. 3 is a block diagram showing a specific example of the internal configuration of the zone ECU 12. As shown in FIG.
The zone ECU 12 shown in FIG. , 4 systems of standby output circuits 49a to 49d, and 6 systems of output circuits 51a to 51f.

The control circuit 41 incorporates various control elements such as a microcomputer and memory, like a general computer unit. Also, various software necessary for the operation of this microcomputer is held in non-volatile memory so that it can be updated.

In the example of FIG. 3, two ECUs 13A, 13B are connected to the output sides of output circuits 46, 47 of the zone ECU 12. In the example of FIG.
A power supply circuit 42 in the zone ECU 12 is connected to the power supply and ground (GND) of the vehicle 17 .

Communication circuits 43 and 48 in the zone ECU 12 are connected to a communication network on the vehicle 17 such as CAN (Controller Area Network), and are used for communication between the zone ECU 12 and other ECUs.

The four systems of standby input circuits 44a to 44d and the six systems of input circuits 45a to 45f are interfaces for inputting signals from vehicle-mounted electrical components assigned in advance, and are divided into three types. The six systems of input circuits 45a to 45f are divided into groups that are allowed to operate only in a normal state, such as when the ignition is on. The four systems of standby input circuits 44a to 44d are classified into standby-required groups so that standby operation can be performed even when the ignition is turned off. Want” is divided into two groups.

Important functions, such as event data recorders and intrusion detection, are assigned to groups requiring standby (M), which are desired to operate until the voltage is very low. In addition, comfortable/convenient functions of relatively low importance, such as remote keyless devices and smart keys, are assigned to the waiting (W) group.

In addition, four systems of standby output circuits 49a to 49d and six systems of output circuits 51a to 51f are interfaces for outputting signals to vehicle-mounted electrical components assigned in advance. are divided into

In other words, the six systems of output circuits 51a to 51f are classified into groups that are permitted to operate only in a normal state, such as when the ignition is on. The four systems of standby output circuits 49a to 49d are divided into groups of standby required (M) and standby required (W).

<State change of zone ECU>
FIG. 4 is a block diagram showing an example of state change of each component inside the zone ECU 12 shown in FIG.
In FIG. 4, among the components inside the zone ECU 12, the blocks of the components in the OFF state to which power is not supplied are hatched. Each block of the ECUs 13A and 13B connected to the output side of the zone ECU 12 is also hatched to indicate that power is not supplied.

In the example of FIG. 4, among the four systems of standby required input circuits 44a to 44d, the standby required input circuits 44a, 44b, and 44d belonging to the standby required (W) group are turned off, and the standby required ( Only the standby-required input circuit 44c belonging to the group M) maintains an operable ON state. In addition, among the four systems of standby required output circuits 49a to 49d, the standby required output circuits 49a and 49b belonging to the standby required (W) group are turned off, and the standby required output circuits belonging to the standby required (M) group are turned off. Circuits 49c and 49d remain on.

In fact, even when the ignition is off, when the zone ECU 12 performs a software update, the zone ECU 12 is in normal mode, so that all components within the zone ECU 12 as shown in FIG. become operable. When the system shifts to the power saving mode during the software update process, as shown in FIG. 4, the zone ECU 12 switches to the OFF state except for the components necessary for executing the minimum functions.

<Example of battery voltage change>
<If software update cannot be started>
FIG. 5 is a time chart showing an example of battery voltage changes when software update cannot be started due to voltage prediction. In FIG. 5 , the horizontal axis represents changes in time t, and the vertical axis represents changes in the output voltage [V] of the vehicle battery 15 .

When the ignition of the vehicle 17 is turned off, the power supply from the alternator 16 is stopped. Therefore, in a situation where the power supply current is flowing to the load such as the zone ECU 12, the battery voltage Vx is increased as indicated by the solid line in FIG. (For example, the detected value) gradually decreases along a straight line with a substantially constant slope.

When the zone ECU 12 is about to start software update (SU) at time t1 shown in FIG. It is necessary to confirm. Therefore, the zone ECU 12 calculates the predicted voltage Vp at step S01 at time t1, and compares the predicted voltage Vp at the time when the update is completed with the low voltage threshold VL1. The low voltage threshold VL1 is predetermined based on the lowest power supply voltage that must be maintained to prevent the battery of the vehicle 17 from dying.

In the example of FIG. 5, it becomes clear at time t1 that the predicted voltage Vp will be lower than the low voltage threshold VL1 at time t2 in the future. Therefore, in this case, the zone ECU 12 determines in step S02 not to start software update. As a result, for example, when the zone ECU 12 is switched to the sleep state, it is possible to suppress the voltage drop of the in-vehicle battery 15, thereby preventing the dead battery.

<When software update can be started>
FIG. 6 is a time chart showing an example of battery voltage changes when software update can be started by voltage prediction. In FIG. 6 , the horizontal axis represents changes in time t, and the vertical axis represents changes in the output voltage [V] of the vehicle battery 15 .

In the example of FIG. 6, it is found that the predicted voltage Vp predicted in step S01 at time t1 is higher than the low voltage threshold VL1 at the end of software update (t2). Therefore, the zone ECU 12 starts software update at time t1 in step S02B.

However, the actual voltage Vx does not always change in the same manner as the predicted voltage Vp, and the voltage Vx may drop faster than the predicted voltage Vp as shown in FIG. Therefore, the zone ECU 12 compares the actual voltage Vx with the low voltage caution threshold VL2 to detect a voltage drop earlier than expected. The low voltage warning threshold VL2 is greater than the low voltage threshold VL1 and is predetermined as a threshold to be wary of a faster than expected drop in voltage Vx.

Then, when the actual voltage Vx drops to the low voltage warning threshold VL2, the zone ECU 12 turns off the standby circuit (W) in step S03, shifts to the power saving mode, and predicts the predicted voltage Vp2 again. Execute.

In other words, when the actual voltage Vx drops to the low voltage caution threshold VL2, if the state continues, the voltage Vx may drop to the low voltage threshold VL1 or less earlier than the expected time t2 when the software update is completed. is assumed. However, when the zone ECU 12 shifts to the power saving mode, the rate of decrease in the voltage Vx slows down, so there is a possibility that the voltage Vx can remain above the low voltage threshold VL1 until the estimated time t2 when the software update is completed. Therefore, prediction of predicted voltage Vp2 is performed again.
In the example of FIG. 6, it is found that the predicted voltage Vp2 does not reach the low voltage threshold VL1 until time t2, so the zone ECU 12 continues the software update while in the power saving mode (S04).

<Software update control>
FIG. 7 is a flow chart showing the contents of software update control in the zone ECU 12 . The control of FIG. 7 will be described below.

The zone ECU 12 calculates the predicted voltage Vp as shown in FIGS. 5 and 6 in S11. For example, based on the change tendency of voltage Vx detected up to time t1 in FIG. 5 and the voltage Vx at time t1, future changes in voltage Vx at each time t after time t1 can be predicted. That is, the expected voltage Vp(t) can be estimated as a function of a straight line that approximates the expected change in voltage Vx. Then, the value of the predicted voltage Vp at the time (t2) when the software update is completed can be calculated. Further, the required time (t2-t1) from the start of the software update to its completion can be estimated based on, for example, the size of the update data existing in the update-dedicated memory area 12a, the number of files, and the like.

The zone ECU 12 compares the value Vp (t2) of the predicted voltage Vp at the predicted software update completion time (t2) with the low voltage threshold VL1 (S12). Then, when the predicted voltage value Vp(t2) is equal to or lower than the low voltage threshold value VL1, the process proceeds to S13, so in this case software update is not started.

If the predicted voltage value Vp(t2) is greater than the low voltage threshold value VL1, the process proceeds to S14, and the zone ECU 12 starts the corresponding software update process. Thereafter, the zone ECU 12 determines in S15 whether or not the software update process has been completed. If not, the process proceeds to S16. Then, the zone ECU 12 compares the latest voltage Vx actually detected by measurement with the low voltage warning threshold VL2 in S16. While the condition of "Vx≤VL2" is satisfied, the zone ECU 12 returns from S16 to S14 and continues the software update process.

When the zone ECU 12 detects that the voltage Vx has become equal to or lower than the low voltage caution threshold VL2, the process proceeds from S16 to S17. Then, the current progress rate Rx of the software update is calculated, and the progress rate is compared with a predetermined update continuation threshold value R1. This progress rate Rx is calculated as a ratio based on, for example, the amount of data and the number of files that have been updated by the zone ECU 12 up to now, among the update data in the update-dedicated memory area 12a, and the total amount of update data and the total number of files. can.

Here, if the current progress rate Rx is less than the update continuation threshold value R1, the zone ECU 12 suspends the software update in S17.
If the current progress rate Rx is equal to or greater than the threshold value R1 for continuation of updating, the process proceeds from S17 to the next S18, and the zone ECU 12 switches itself to the power saving mode. In other words, the power supply to the circuits other than the standby required circuit (M) necessary for the continuation of the subsequent processing is stopped, and the state shown in FIG. 4 is established. Thereby, power consumption from the vehicle-mounted battery 15 can be suppressed.

Zone ECU 12 again predicts the change in voltage Vx after that time as predicted voltage Vp2 in the next step S19. In this case, the predicted voltage Vp2 is calculated while reflecting the change in the actual voltage Vx until S19 is executed and the effect of switching to the power saving mode.

The zone ECU 12 compares the calculated value Vp2 (t2) of the predicted voltage Vp2 at the software update completion time (t2) with the low voltage threshold VL1 in the next S20. Then, if the predicted voltage Vp2(t2) at the completion of the software update is equal to or lower than the low voltage threshold VL1, the software update is interrupted (S20).

Further, if the predicted voltage Vp2(t2) at the software update completion time is greater than the low voltage threshold VL1, the zone ECU 12 proceeds from S20 to S21 and continues the software update currently being processed.

Thereafter, the zone ECU 12 determines in S22 whether or not the software update process has been completed, and if not completed, the process proceeds to S23. Then, the zone ECU 12 compares the latest voltage Vx actually detected by measurement with the low voltage threshold VL1 in S23.

While the condition "Vx>VL1" is satisfied, the zone ECU 12 returns from S23 to S21 and continues the software update process. On the other hand, when the condition of "Vx≤VL1" is satisfied, the zone ECU 12 suspends the software update (S23).

Therefore, when the zone ECU 12 executes the control shown in FIG. 7, the operations shown in FIGS. 5 and 6 become possible. That is, even if the actual decrease speed of the voltage Vx becomes "Vx≦VL2" faster than expected after the condition "Vp1(t2)>VL1" is satisfied in S12 and the software update is started. If the progress rate Rx is large, the software update can be continued by switching to the power saving mode. As a result, it is possible to reduce the frequency of software update interruptions while reliably preventing the battery from running out. In other words, it becomes possible to reduce situations where the same software update is repeated many times.

<Modified Example of Zone ECU>
FIG. 8 is a block diagram showing the internal configuration of the zone ECU 12A in the modified example. The zone ECU 12A shown in FIG. input circuit 65, power supply units 66 and 67, communication circuits 68 and 69, and output circuits 71, 72 and 73.

The output side of the output circuit 71 is connected to the ECU 13A, and the output side of the output circuit 72 is connected to the ECU 13B.
In addition, in the zone ECU 12A of FIG. 8, it is possible to supply three independent power sources "A", "B", and "C" in order to switch between three states.

The control circuit 61 containing the microcomputer is constantly supplied with the "A" system power supply, and is additionally supplied with the "B" system power supply power from the power supply unit 66. System power is supplied from the power supply unit 67 .

Each standby input circuit 64 operates with the power supply of the "A" system. The communication circuits 63 and 69, the power supply section 66, the output circuits 71 and 72 are operated by the "B" system power supply. Further, each input circuit 65, power supply section 67, communication circuit 68, and each output circuit 73 are operated by the power supply of the "C" system.

If the vehicle 17 allows relatively large power consumption in the zone ECU 12A, such as when the vehicle 17 ignition is on, the normal power supply for all circuits in the zone ECU 12A shown in FIG. supply power. In other words, the three power sources "A", "B", and "C" are supplied to each circuit in the zone ECU 12A. This is the normal mode during activation of the zone ECU 12A. The control circuit 61 in this normal mode is in a (RUN) state in which normal operation is possible.

<Status change in software update mode>
FIG. 9 is a block diagram showing an example of state change of each component inside the zone ECU 12A in the software update (OTA-SU) mode. In FIG. 9, each component in a state different from the normal mode is shown as a hatched block.

As shown in FIG. 9, in this software update mode, the "C" system power supply to each input circuit 65, power supply unit 67, communication circuit 68, and each output circuit 73 is stopped. Also, the control circuit 61 is in a state in which power consumption is suppressed (STOP). The power supply circuit 62, the communication circuit 63, each standby input circuit 64, the power supply unit 66, the communication circuit 69, the output circuits 71, and 72 are supplied with the power supply of the "A" or "B" system. It is ready for operation.

Therefore, in the software update mode shown in FIG. 9, the power consumption of the zone ECU 12A is significantly reduced as compared with the normal mode shown in FIG.

<Sleep mode state change>
FIG. 10 is a block diagram showing an example of state change of each component inside the zone ECU 12A in sleep mode. In FIG. 10, each component in a state different from the normal mode is shown as a hatched block.

As shown in FIG. 10, in this sleep mode, the "C" system power supply to each input circuit 65, power supply unit 67, communication circuit 68, and each output circuit 73 is stopped. The "B" system power supply to the unit 66, the communication circuit 69, the output circuits 71 and 72 is stopped. Also, the control circuit 61 is in a state in which power consumption is greatly reduced (Deep-STOP).

Therefore, in the sleep mode shown in FIG. 10, power consumption of the zone ECU 12A is further reduced than in the software update mode of FIG.

In other words, by switching the states of FIGS. 8, 9, and 10, it is possible to selectively use the three types of power consumption states. Table 1 below shows a list of function on/off (ON/OFF) divisions of each part in the zone ECU 12A in these three types of modes.

Note that "standby I/O required" in Table 1 corresponds to an input/output (I/O) interface for connecting with, for example, a remote keyless function or a smart key function. Also, "ON" of the "CAN" system in the software update mode in Table 1 is limited only to buses related to the software update.

<Operation of zone ECU 12A>
FIG. 11 is a flow chart showing mode transition control in the zone ECU 12A of FIG.
Even when using the zone ECU 12A of FIG. 8, the operation of downloading the update data from the cloud 20 and storing it in the update dedicated memory area 12a is performed while the vehicle 17 is running, that is, when the ignition is on. In addition, whether or not the software can be updated is confirmed in advance by the driver's input operation. If the driver has previously permitted the software update, the zone ECU 12A starts processing for the software update after the ignition is switched off.

The contents of the control shown in FIG. 11 will be described below.
The zone ECU 12A starts processing from step S31 in FIG. 11 when operating in the normal mode. The zone ECU 12A identifies in S11 whether or not a predetermined sleep condition is ON.

For example, any one of, for example, the ignition is off, the door is open, and the key is locked, or a combination of these conditions is identified as the sleep condition in S31. If the sleep condition is ON, the zone ECU 12A proceeds from S31 to S32.

In S32, the zone ECU 12A identifies the presence or absence of software update. That is, it identifies whether or not update data that can be used to update the software of the zone ECU 12A or the like is stored in the update dedicated memory area 12a. If there is software update, the process proceeds from S32 to S33, and if there is no software update, the process proceeds from S32 to S35.

The zone ECU 12A transitions to the software update mode shown in FIG. 9 before starting the software update process (S33). As a result, the software update can be executed under the condition that the power consumption of the zone ECU 12A is suppressed.

The zone ECU 12A starts software update processing in S34. After the software update process is completed, the process proceeds to the next step S35.
The zone ECU 12A transitions to the sleep mode shown in FIG. 10 in S35. As a result, the power consumption of the zone ECU 12A becomes very small, and the voltage of the vehicle-mounted battery 15 is hardly affected.

The zone ECU 12A identifies in S36 whether or not a predetermined wakeup condition is ON, and if the wakeup condition is ON, the transition to the normal mode shown in FIG. 8 is performed in the next S37.

As described above, in the in-vehicle system 10 shown in FIG. 1, the zone ECU 12 can implement the in-vehicle software update method such as the operation shown in FIG. Therefore, even in a situation where the actual voltage Vx of the on-vehicle battery 15 drops faster than the prediction voltage Vp as shown in FIG. Migrating may allow software updates to continue uninterrupted. This makes it possible to reduce the frequency with which software updates are interrupted. In other words, it is possible to avoid repeating the same software update, enabling efficient software update.

In particular, in the operation of FIG. 7, when the voltage Vx drops to the low voltage caution threshold VL2, the predicted voltage Vp2 is recalculated (S19) in consideration of switching to the power saving mode (S18). It is more likely that the update can continue to the end.

In addition, the zone ECU 12 downloads when the ignition of the vehicle 17 is on, and starts updating the software after the ignition is switched off, so that the software can be updated efficiently. That is, when the ignition is off, the influence of interruptions by other ECUs unrelated to the software update is less likely to occur, so the software can be updated in a favorable environment.

Further, even after the zone ECU 12 switches to the power saving mode during software update, the zone ECU 12 controls to maintain the battery voltage equal to or higher than the low voltage threshold VL1 (S23). can be prevented.
Further, by switching the operation mode of the zone ECU 12A as shown in FIGS. 8 to 10, it is possible to more effectively prevent the battery from running out due to software update.

Here, the features of the in-vehicle software update method and the in-vehicle system according to the embodiments of the present invention described above are briefly summarized in [1] to [5] below.
[1] In-vehicle software for updating software included in an in-vehicle system (10) having a zone control unit (zone ECU 12) capable of managing a plurality of controlled objects (terminal ECU 13, smart actuator 14) connected downstream. A method of updating,
holding the acquired update data in a first area (update-dedicated memory area 12a) secured in advance in the memory of the zone control unit;
before starting software update using the update data, calculating a predicted voltage value of the vehicle power supply at the time of completion of the update as a first predicted voltage value (predicted voltage Vp);
When the first voltage prediction value is equal to or greater than the first threshold (low voltage threshold VL1), software update is started (S12, S14),
Acquire the voltage measurement value (voltage Vx) of the vehicle power supply after starting the software update,
When the voltage measurement value drops to a second threshold (low voltage warning threshold VL2), a progress rate in the software update is acquired (S17),
interrupting the software update if the progress rate is less than a predetermined set value;
If the progress rate is equal to or greater than the set value, the mode is switched to the power saving mode (S18), the voltage predicted value of the vehicle power supply at the time of completion of the update is calculated as a second voltage predicted value (predicted voltage Vp2), and the second voltage predicted value is calculated. is equal to or greater than the first threshold (low voltage threshold VL1), the software update is continued (S21),
Vehicle software update method.

[2] An in-vehicle system (10) having a zone control unit (zone ECU 12) capable of managing a plurality of controlled objects (terminal ECU 13, smart actuator 14) connected downstream,
The memory of the zone control unit has a first area (update-only memory area 12a) capable of holding update data that can be used for updating software of a plurality of controlled objects,
The zone control unit
(S11) a function of calculating a predicted voltage value of the on-vehicle power supply at the time of completion of the update as a first predicted voltage value (predicted voltage Vp) before starting the software update using the update data in the first region;
a function of starting software update (S12, S14) when the first voltage prediction value is equal to or greater than a first threshold (low voltage threshold VL1);
A function of acquiring the voltage measurement value (voltage Vx) of the onboard power supply after starting the software update (S16);
A function of acquiring a progress rate in the software update (S17) when the voltage measurement value drops to a second threshold (low voltage caution threshold VL2);
a function of interrupting the software update if the progress rate is less than a predetermined set value (S17);
If the progress rate is equal to or greater than the set value, the mode is switched to the power saving mode (S18), the voltage predicted value of the vehicle power supply at the time of completion of the update is calculated as a second voltage predicted value (predicted voltage Vp2), and the second voltage predicted value is calculated. is a first threshold (low voltage threshold VL1) or more, the software update is continued (S21);
In-vehicle system with

[3] The zone control unit assigns a priority to each of the plurality of electric circuits under its control, and in the power saving mode, suppresses power supply to an electric circuit with a lower priority among the plurality of electric circuits. (see FIG. 4) to reflect changes in power supply in the calculation of the second voltage prediction value (prediction voltage Vp2);
The in-vehicle system according to [2] above.

[4] The zone control unit stores the update data downloaded from a predetermined software supplier in the first area when the ignition of the vehicle is on, and stores the update data after the ignition is switched off. switch to data-based software update mode,
The in-vehicle system according to [2] or [3] above.

[5] After switching to the power saving mode, the zone control unit repeatedly acquires the voltage measurement value of the vehicle power supply, and the voltage measurement value (voltage Vx) reaches the first threshold (low voltage threshold VL1). If it has decreased, the software update is interrupted (S23),
The in-vehicle system according to any one of [2] to [4] above.

10 in-vehicle system 11 central ECU
12, 12A Zone ECU
12a Update dedicated memory area (first area)
12b update processing unit 13 terminal ECU
13A, 13B ECUs
13a update processing unit 14 smart actuator 14a update processing unit 15 vehicle battery 16 alternator 17 vehicle 18, 19 communication line 20 cloud 25 wireless data communication 31, 31A, 32, 32A, 33, 33A update program 41 control circuit 42 power supply circuit 43, 48 communication circuits 44a, 44b, 44c, 44d standby required input circuits 45a, 45b, 45c, 45d, 45e, 45f input circuits 46, 47 output circuits 49a, 49b, 49c, 49d standby required output circuits 51a, 51b, 51c, 51d , 51e, 51f output circuit 61 control circuit 62 power supply circuit 63, 68, 69 communication circuit 64 standby input circuit 65 input circuit 66, 67 power supply unit 71, 72, 73 output circuit SG-IG ignition signal VL1 low voltage threshold VL2 Low voltage warning threshold Vp, Vp2 Predicted voltage Vx Voltage

Claims (5)

An in-vehicle software update method for updating software included in an in-vehicle system having a zone control unit capable of managing a plurality of controlled objects connected downstream,
holding the acquired update data in a first area secured in advance in the memory of the zone control unit;
calculating, as a first voltage prediction value, a voltage prediction value of the on-vehicle power supply at the time of completion of the update before starting the software update using the update data;
If the first voltage prediction value is equal to or greater than a first threshold, software update is started;
Get the voltage measurement value of the on-board power supply after starting the software update,
Acquiring a progress rate in the software update when the voltage measurement value decreases to a second threshold;
interrupting the software update if the progress rate is less than a predetermined set value;
If the progress rate is equal to or greater than the set value, the mode is switched to the power saving mode, the voltage prediction value of the vehicle power supply at the time of completion of the update is calculated as a second voltage prediction value, and if the second voltage prediction value is equal to or greater than the first threshold. continues said software update,
Vehicle software update method. An in-vehicle system having a zone control unit capable of managing a plurality of controlled objects connected downstream,
The memory of the zone control unit has a first area capable of holding update data that can be used for updating software of a plurality of controlled objects,
The zone control unit
A function of calculating, as a first predicted voltage value, a voltage predicted value of an on-vehicle power supply at the time of completion of updating, before starting a software update using the update data in the first area;
a function of starting a software update when the first voltage prediction value is equal to or greater than a first threshold;
A function to obtain the voltage measurement value of the on-board power supply after starting the software update;
a function of acquiring a progress rate in the software update when the voltage measurement value decreases to a second threshold;
a function of interrupting the software update if the progress rate is less than a predetermined set value;
If the progress rate is equal to or greater than the set value, the mode is switched to the power saving mode, the voltage prediction value of the onboard power supply at the time of completion of the update is calculated as a second voltage prediction value, and if the second voltage prediction value is equal to or greater than the first threshold. is a function to continue the software update;
In-vehicle system with The zone control unit assigns a priority to each of the plurality of electric circuits under management, and switches to a state of suppressing power supply to an electric circuit having a lower priority among the plurality of electric circuits in the power saving mode. , reflecting changes in power supply in the calculation of the second voltage prediction value;
The in-vehicle system according to claim 2. The zone control unit stores the update data downloaded from a predetermined software supplier in the first area when the ignition of the vehicle is on, and uses the update data after the ignition is switched off. switch to software update mode with
The in-vehicle system according to claim 2 or 3. After switching to the power saving mode, the zone control unit repeatedly acquires the voltage measurement value of the vehicle power supply, and if the voltage measurement value drops to a first threshold, interrupts the software update.
The in-vehicle system according to any one of claims 2 to 4.

Images